DNS Tunneling C2: High-Entropy Subdomains, TXT/NULL, or Query Spikes

Ibrahim Saud@tektrix

•updated Sep 24, 2026•1•0•0

Detects potential DNS tunneling or Command and Control (C2) communication patterns. The rule calculates subdomain entropy to identify unusually long or randomized subdomain labels, monitors for excessive DNS query volume per client, and flags the use of specific record types (TXT, NULL) often associated with C2 frameworks like dnscat2 or iodine.